For the record, needed to set s3-ext-authenticationregion to match the same as “region” in the default attributes.